{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-46845", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-11T15:12:18.289Z", "datePublished": "2024-09-27T12:39:38.315Z", "dateUpdated": "2026-08-05T11:38:57.813Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:38:57.813Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/timerlat: Only clear timer if a kthread exists\n\nThe timerlat tracer can use user space threads to check for osnoise and\ntimer latency. If the program using this is killed via a SIGTERM, the\nthreads are shutdown one at a time and another tracing instance can start\nup resetting the threads before they are fully closed. That causes the\nhrtimer assigned to the kthread to be shutdown and freed twice when the\ndying thread finally closes the file descriptors, causing a use-after-free\nbug.\n\nOnly cancel the hrtimer if the associated thread is still around. Also add\nthe interface_lock around the resetting of the tlat_var->kthread.\n\nNote, this is just a quick fix that can be backported to stable. A real\nfix is to have a better synchronization between the shutdown of old\nthreads and the starting of new ones." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached only through local file operations on tracefs (`open`/`read`/`close` on `osnoise/per_cpu/cpuN/timerlat_fd` plus writes to `current_tracer` and `osnoise/options`). There is no network or remote-peer input involved.\nAC:L - The attacker controls both sides of the race — they terminate their own timerlat user threads (which close fds one at a time, giving a wide window) while concurrently starting a second timerlat instance that memsets the still-armed per-cpu hrtimers, and can retry the loop indefinitely. CONFIG_TIMERLAT_TRACER is enabled in mainstream distro kernels, so no rare configuration is required.\nPR:L - Default tracefs permissions are root-only, but tracefs explicitly supports `uid=`/`gid=`/`mode=` mount options and it is common practice (Android tracing group, developer/CI/RT-tuning hosts, tracing sidecar containers with /sys/kernel/tracing mounted rw) to grant an unprivileged user or group full tracing access so rtla/trace-cmd can run without root; in that reasonable deployment a basic local user performs the whole sequence.\nUI:N - The attacker performs every step themselves — enabling the tracer, opening the per-cpu timerlat fds, killing the threads, and restarting a second instance. No victim action is needed.\nS:U - The corruption is confined to kernel hrtimer state within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The bug is an upstream-acknowledged use-after-free on an hrtimer that remains enqueued in the per-CPU hrtimer_clock_base rb-tree after being zeroed and re-initialized, giving corruption of timer-subsystem structures that can be groomed into arbitrary kernel-memory reads.\nI:H - A stale rb-node left in the hrtimer timerqueue with zeroed links causes subsequent `rb_insert_color`/`rb_erase` operations to write through attacker-influenceable pointers, and the freed/re-initialized timer's `function` field is a call target — a write and control-flow-hijack primitive.\nA:H - Even without full exploitation the bug reliably crashes the kernel: `hrtimer_cancel()` dereferences a NULL `timer->base`, and the next hrtimer interrupt dequeues the zeroed node and calls a NULL `timer->function` in hardirq context, panicking the machine." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/trace/trace_osnoise.c" ], "versions": [ { "version": "e88ed227f639ebcb31ed4e5b88756b47d904584b", "lessThan": "8c72f0b2c45f21cb8b00fc37f79f632d7e46c2ed", "status": "affected", "versionType": "git" }, { "version": "e88ed227f639ebcb31ed4e5b88756b47d904584b", "lessThan": "8a9d0d405159e9c796ddf771f7cff691c1a2bc1e", "status": "affected", "versionType": "git" }, { "version": "e88ed227f639ebcb31ed4e5b88756b47d904584b", "lessThan": "e6a53481da292d970d1edf0d8831121d1c5e2f0d", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/trace/trace_osnoise.c" ], "versions": [ { "version": "6.5", "status": "affected" }, { "version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.51", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10.10", "lessThanOrEqual": "6.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.11", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.51" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.10.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.11" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/8c72f0b2c45f21cb8b00fc37f79f632d7e46c2ed" }, { "url": "https://git.kernel.org/stable/c/8a9d0d405159e9c796ddf771f7cff691c1a2bc1e" }, { "url": "https://git.kernel.org/stable/c/e6a53481da292d970d1edf0d8831121d1c5e2f0d" } ], "title": "tracing/timerlat: Only clear timer if a kthread exists", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-09-29T13:59:07.271021Z", "id": "CVE-2024-46845", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-29T13:59:12.034Z" } } ] } }